At 03:38 on Monday 24 August, traffic began surging towards the infrastructure that runs Norway's public digital services. More than thirty hours later it was still arriving in waves. Ten services were disrupted, led by ID-porten, the national identity gateway, as the Norwegian Digitalisation Agency (Digdir) confirmed and The Record and The Local reported.
It was the third distributed denial-of-service (DDoS) attack on the agency since June, and the largest: “two to three times larger” than the previous ones, as press officer Are Kvistad put it to the NTB news agency. Speaking to Associated Press, the same spokesperson called it the biggest attack Digdir has ever faced, and added the qualification that matters: technicians kept the services running “practically all the time”.
According to Digdir, no one broke into the systems and no data was compromised. The effect was of a different order: a whole country struggling to use its own services.
Three attacks in three months, and what each one taught
June: 42 hours without the identity gateway
Over the weekend of 20 to 22 June, the ID-porten infrastructure at Digdir's operations provider was out of service for roughly 42 hours during a DDoS attack, as the agency itself reported. That weekend delivered the first lesson: to take the service down, the attackers went for its supplier, the shared layer everything else runs on.
The timing looks deliberate too: a mid-June weekend, when on-call cover tends to be at its thinnest.
3 August: prescriptions that would not load
On Monday 3 August, pharmacies across the country struggled to retrieve electronic prescriptions, and sign-ins to Helsenorge, Altinn and municipal services had been failing since the early hours. Beneath every one of those failures sat the same component: ID-porten, which channels access for more than 4.5 million people to some 5,000 public services, according to figures cited by Aftenposten. Most services were back that evening and normal operation was declared on Tuesday morning, according to the reconstruction by Norwegian threat-intelligence firm Revontulet.
Lesson two is the cascade. A pharmacy has no daily dealings with a digitalisation agency; nor does a hospital or a town hall. All of them, though, share the same front door, and the paper fallbacks that survive are not designed for that load.
From 24 August: the largest so far
Round three began in the small hours of Monday the 24th and stretched past the thirty-hour mark; on the Wednesday, according to AP, it was still being described as ongoing. Technicians stabilised the systems on Monday afternoon, then conditions worsened again in the evening. Health authorities warned of possible problems reaching online pharmacies and the electronic prescription system, and Digdir tracked the situation on its public status page.
Mitigation is the third lesson. Digdir did not stop the attack, but it absorbed most of it: as Kvistad himself acknowledged, the services held (degraded, with intermittent outages), but they held. Against a volumetric DDoS of this scale, that counts as a win.
Who is behind the attacks on Norway?
The June and early-August attacks went unclaimed for weeks, and Digdir declined to speculate. Then on Wednesday 26 August the pro-Russian group Server Killers claimed the third attack on Telegram, saying it had “declared cyber war” on Norway after the country renewed its security cooperation with Ukraine on 23 August, as Associated Press reported. For now it is only the attacker's word: Norwegian officials had not commented on the claim at the time of publication, and the two earlier attacks remain unattributed.
The pattern fits a much wider wave, part of the hybrid pressure Europe has been absorbing for years. The UK's National Cyber Security Centre (NCSC) keeps an active advisory on DDoS activity by pro-Russia hacktivist groups against British organisations. Danish authorities blamed NoName057(16) for attacks on Danish websites ahead of the 2025 local elections, according to AP. Norway has its own precedent: when a political party's website went down six days before last September's election, NoName057(16) claimed it the same day, as public broadcaster NRK reported.
Before anyone imagines a sophisticated operation, one fact is worth bearing in mind: DDoS capacity is for hire, no botnet of your own required. Operation PowerOFF, the Europol-coordinated action against paid DDoS services, took down 53 domains and gained access to databases holding more than three million user accounts. With that market in place, the candidates range from criminals with rented firepower to state actors timing a country's reactions. The operations provider under attack told Aftenposten that attacks of this kind tend to be the work of foreign powers or other well-resourced actors.
Dominant in volume, minor in effect: why it keeps working
ENISA's latest threat landscape, covering 4,875 incidents between July 2024 and June 2025, ranks DDoS as the dominant incident type in the EU: 77% of reported incidents, most of them the work of hacktivists. Hacktivism as a whole accounts for almost 80% of incidents, and yet only 2% of those actions actually disrupted a service. Public administration was the hardest-hit sector, at 38.2% of the total.
Read together, those figures explain why hacktivist DDoS is so often dismissed as background noise. Norway shows the other side of the coin. When the flood lands on a shared dependency, that 2% turns into a country postponing prescriptions and filings.
ENISA's executive director, Juhan Lepassaar, put it plainly when presenting the report: the systems we rely on daily are intertwined, and a disruption at one end can ripple across the whole chain. Norway's security service NSM had already flagged the point in its 2026 risk report: dependence on external suppliers is a vulnerability in itself; the same report warned of Russian intelligence services' appetite for sabotage against Norwegian targets.
None of this is a spectator sport. Many countries run a comparable gateway, and most mid-sized organisations have their own version of the problem: a single corporate sign-in, an API gateway or an operations provider whose failure drags everything else down with it.
What an organisation with a single front door can do
The first move is to map the dependencies, ideally before the next Monday at 03:38: which services fail if the identity gateway, the operations provider or DNS goes down, and what mitigation each provider has committed to in writing. In the Norwegian case, all three attacks fell on the same provider's infrastructure. That is what third-party risk management exists for: knowing those commitments, and what happens when they fail.
Next comes architecture. A volumetric DDoS gets absorbed upstream, in the carrier's network or through traffic-filtering services contracted in advance; your own firewall is simply too late. What does sit with each organisation is degrading gracefully, which means deciding in advance what gets sacrificed first: separating critical flows from expendable ones, keeping alternative authentication routes for the processes that cannot afford to stop, and letting anything that does not need a session run without one.
Operations complete the list. A thirty-hour attack in waves is managed with shifts, a status page hosted away from the affected infrastructure, and honest communication with users and authorities from the first hour. Digdir got several of these right and still had two rough days; improvising them mid-incident tends to end badly. An incident response plan that includes the denial-of-service scenario, rehearsed once a year, costs a fraction of discovering mid-incident that it was missing.
At Hard2bit we see it often when reviewing architectures: the list of critical dependencies exists, but no one has checked what happens when one of them disappears for a day and a half. A security operations centre (SOC) that watches availability as seriously as it watches intrusions changes the outcome more than any last-minute purchase.
Does availability count as a security incident?
It does, and increasingly so. NIS2 defines significant incidents by operational disruption, with or without data theft: a severe outage of an essential service triggers the same notification clock (early warning within 24 hours, notification within 72) as a breach. According to ENISA's own report, 53.7% of the incidents analysed concerned essential entities as the directive defines them.
For financial entities, DORA adds a test: operational resilience is not declared; it is demonstrated through exercises. And for everyone, the starting point is the one the Norwegian summer left behind: business continuity can no longer be modelled on the assumption that identity, DNS or the operations provider will always be there.
The underlying failure is not Norwegian
A decade of consolidating digital services onto common platforms bought efficiency and paid for it in fragility. That holds for a state, and it holds for companies that funnel everything through one point of access. This summer's attacks needed no technical vulnerability. Whoever was behind them, the result was a public measurement: how long it takes a country to regain access to its services, three times over.
Revontulet's reconstruction stresses that the attackers return to the same targets and learn from every attempt. It is safe to assume that whoever sent that traffic is not the only one studying those results. The size of the next attack matters less than the variable defenders have most say over: how long they can keep operating while it lasts.
The question the Norwegian summer leaves behind is a concrete one: how long would your organisation last if it lost its single point of access tomorrow, and who has actually checked? At Hard2bit we have spent years running that check with organisations that depend on a shared layer, and it almost never comes out clean the first time.
Sources and attribution: this analysis draws on public disclosures by Digdir and the information available as of 27 August 2026, as reported by The Record, Associated Press, The Local, NRK and Aftenposten, together with data from ENISA, NSM and Europol. No mention implies a security flaw in the products or services named: the attacks described are denial-of-service events and, according to Digdir, no systems or data were compromised. The Server Killers claim is an attacker's statement without independent verification, and attributions for campaigns of this kind may evolve.
This article is an informational analysis based on public sources and does not constitute security advice for any specific case. Each organisation should assess the measures discussed against its own architecture, dependencies and regulatory obligations before applying them.
